login now starts a session, still no fancy redirect