current user moved to session mixed with cookie