created manage_sessions behavior and built login behavior.  removed from routes/user