removed output buffering for virtual()
moved cross hash session stuff from user class to own
changed to auth class