- fixed login security to hold session var