username now read from session