login check using session object