login and capture session token