keep login and logout status using sessions