login problem with reusing session id