removed login url from session response