changed from autologin-session to user-session