changed user.js so we don't reload req.session.user when it's already set