added session based login/logout