changed user/follow to use session