don't add user to session until after authentication (the code to add user to session should be probably be moved to the view).