refactor login / account / session