This should come from the user object rather than the session