wrong logic for redirecting to the login page.. should only do that if there is no session, not if there is one!