update Session to hand user explicitely.