sessioning/log in and out works, but no password