auth: configurable SessionUser
auth: SessionUser fixes