flow for logging in if there's no session