added session and login_required decorator