don't execute sessionKey -> User translation for AuthHandler

also make the condititions more read-able