make sure user is in session before using it