automatically destroy session if on login page