changed session.user to set full user obj