1. add login user in  crossp success handler
2. instead of session user for all web interface