signup works, but without sessions