authentication/session refactoring and improvements, store user object instead of userId and refresh it while loading static content