fix login problem: handle public sessions correctly