Protected the user.php script by a session