session and user updates