handling user session flow, done