update session to handle user explicitly