do_login creates sessionkey