serialize before saving user state data
tuning useridentity and controller to only allow web logins on web actions