proper session user handling