session store, user login flow