refactored session handling and added "logout" behaviour