make sure we get the correct user from the session