add session management for user login