add user & session management