fixed updateSession(), do nothing if user is `false`, eg. post-registration page