Should this depend on if user being logged in is already logged in?
Because we don't recreate session here...