restrict user from creating new account if they have an existing session
implement user account creation
merge user creation into master