added session checking to login: