if one hits /login endpoint multiple times, it makes multiple sessions in db, is this intended?