add user/session functionality