more work on session login/logout