making User serializable so it can be stored in the session scope