session.user rather than session.username