move sessions login into auth folder