separate login storage config, implement Session object