moved the persistent-login function (login:set-user()) up - obviously before user check!