security changes session login handling