add auth plugin, session (config, container), refactor login controller