session invalidated before login