a user log-in session works