use session to implement login and logout