- make sure a user is in the userdb before assuming they're logged on based on session info (allows deleting uerdb item and invalidating all sessions)