discovered bug in session tracking of logged-in user