pass the real user object instread of user_session then signing a login action