session on login, and logout function