login/logout works, session cookie now saves by username