so now, we start the session before knowing if the user provided the correct credentials. IMHO, the session should be started only if the authentication was successful