fix storing user in session