add complex instance of user to session, on logout - remove it from session