login with csfr and session