Login should not return UserSessionData, just a Session is fine