login session is complete, but not perfect. urls are strange.