[change] UserModel option 'lean' removed
[add] UserModel.sessionCreatedAt. updated when signin, removed when signout