keep user logged in until he presses logout