Don't throw ToU exception here.
Always return a Session object from all login() methods.