login.php, session instead of post