removed setting session first_name, can pull from database instead