invalid session if user not found