fix bug for logging with session for nonexistent user