user login persists after session refresh