finish login with sessions