added sessions and users can now confirm their password