sessions for controlling login and logout