first login / session mgmt