only start a session when user is actually logged in