changed session handler to be sure and create user even if user cannot be found in LDAP