use self.session_card_id = User.card_id (Card.id of  card with acct), fix User.autheticate API to return same id