fix auth example

related to https://github.com/cortfritz/derby-examples/commit/8da4482aa3827fe55e9a1eaf83b1708263eb9518
::
but fixes 2nd occurrence of _session.user as well ;))