finalised users and sessions for authentication