user should set into session before postLogin hook otherwise it will break not only the files_encryption app