Using request.session.user not request.user