refactored session handling to new user model