changed user to session attribute