documentation of login/@exposeUserCredentialsToSession