Just always load user from DB, ignore session for now