refactored user/session handling code