login method and ability to call API under user session