check for session.user so that unit tests don't trip over themselves