include Set-Login header on session state transition