moved refreshList to after setting the user in the session.