refresh user login; but it does not clear session; WIP