moved sessionstart to after login