changed login to save id to req.session