login redirect works with session