Why shouldn't they store the user object int he session?