login stuff
merge old http auth branch into current session auth branch