simple session management
login/logout/check