auth session mapper: fetchByUserAndMethod