core: always set the user explicitly in the session.
Don't copy the user from the current context.