finally sorted out user sessions