signed in users now save PRIVATE data in the session