USER_SESSION_ATTRIBUTE now used directly