improved session handling
undefined login/token check