more work on sessions and users