Fix login logic and add SESSION based validation