use user and session