control before updating user session