updated with user login and sessions