user session auth fix