user object added to session.