added sessions to all GET and one edituser POST