used sessions to store log-on state