bug fixed. mismatch between setting session and calling it to set current user