Security of login form using prepared statements
I'll point out a few things here:


$pswd = sha1($pswd); is cringeworthy. Please use password_hash() if you can. If you can't update your PHP version to comply, my next best suggestion is to use crypt().
Having all of your DB connection code on the page is generally considered poor coding. Place everything between $servername ... // statement in a separate file and require it.
In your select statement, there is no reason to retrieve the password from the DB alongside the username. The less you deal with the password, most likely will be safer. Also, you're putting the hashed password in the session, which I'm not sure is the best idea. A phishing attempt could potentially reveal this and a malicious user could take advantage of this information.
Your method of creating a session token is weak, and I suggest you check out this StackOverflow post for more info.
Format your code. You're missing a lot of indentation and general style rules aren't 100% met.