login form, verification and session