let users sign in with facebook

this does not need to be stored in the session