sign up also now creates session