add a check to verify if sessionId was generated against current set of login credentials
session id, url and hash are now part of one json object
#3 login data "hash" is now SHA-256 to reduce chances that it can be used in password guessing