update routes for session login