limit user data in session