session['username'] changed to AnonymousUser instance