Session-based login, logout and authentication