use dict instead of set as set cannot be encoded as JSON (used by flask-login secure cookies)