- #3 move users into user object

also put users in session so we can add it to res.user in /sigin-in route