this should be secured welcome ${session['username']}