use session to keep username around