changed session to validate against username instead of email