bug fix: login works with session