changed session data from token to user