login() now stores the session cookie