* No longer redirects - simply returns usersession obj.
* support error setting - shown on login page in place of "Authentication Required";