check username/password
session set, with a cookie