separate logged in user from Persona's current user, to allow fake testing logins
add comment clarifying new persona_email session field