modified api/login to return session info