add httpsession
add login
some jwt