user object added to "login" response,httpSessionListener added to log
user when session expires