user and session updates