changed session to store user object instead of name