now getting the user object from session instead of request