added user object that holds session information about the user. it is used to determine authentication