added user login, logout (via sessions)