user can sign in. session is created