Remove dependency on HttpSession in UserService

Fixes #644