session user added to all controllers