add routes for session/login/logout