fixed routes to user and session