check for user in request, take off session