login now uses session
merging changes