fixed bug in user controller json format and session hash