add REST_SESSION_LOGIN setting, v0.2.5