FIX: now either an authorization action is done or the user is pulled
from session