When we create the session we actually pass the email and password in the params not in the header.