add user to session at login