update users and session -attempt