users now have a pic url stored in session[:pic]