session users by reference, not a copy