updateUser: return callback is no session