user login with session stored