a little cleanup on the session/login mess...

but could use something cleaner, maybe...