the name change is what made this messy.  I'm not attached to self.session_user, but self.session won't do. too close to "session".