ensure that the user get serialized to the session and deserialized as well
[#10]