Session handling, cleanup, logging

This PR fixes working with sessions. It does not create a session object until necessary. It also adds some more logging to login-code processing.