working session login with passport