final login/logout with session variable