Session login API: don't include success message on successful redirect