login and logout correctly interact with session