login & logout controller function using sessions implemented with active record