use session redirect to
exports user via session