only store guid in the session

This change saves at least 2 kb of db transfers per request for logged in users.