simplify login/session logic, add a bit to the README