session: use correct policy for rpc_handle_login()