first go-round of session based logins.  still needs some re-factoring