login complete and fixed sessions, body and params