move all user login/session code to user_session.py