update user session(auth)