websession -> legacy.websuser (dirty)