login and log out uses sessions