added sessions for login/user auth