login: session data now include groups.