keep a session id and a username on the session