Why not store the users id in the session, then use it to pull the user out of the database?