return session key in login