changed to sessions instead of using login pages