make handling of user sessions more threadsafe