         if err or @data == null
           @create(cb)
         else
+          #TODO - clean this bit up as a result of not having to sanitize hashes in JSON 
+          parsedAttributes = JSON.parse @data.attributes if @data.attributes?
+          @data.user_id = parsedAttributes._id if parsedAttributes? and parsedAttributes._id? #HACK
           @id = @cookies.session_id
-          @assignUser(@data.user_id.toString()) if @data.user_id
-          cb(null, @)
+          if @data.user_id
+            @assignUser @data 
+            cb(null, @)
+          else
+            cb(null, @)
     else
       @create(cb)
 

    @user = null
    @create (err, new_session) -> cb(null, new_session)    

  # AUTH - rip out
  save: ->
    R.hset @key(), 'user_id', @user.id if @user

class exports.RedisSession extends Session  
  
  getAttributes: ->
    attr = R.hget @key(), 'attributes'
    JSON.parse if attr is undefined then '{}'
    
  setAttributes: (new_attributes) ->
    R.hset @key(), 'attributes', JSON.stringify @_mergeAttributes @getAttributes(), new_attributes
                    
  _mergeAttributes: (old_attributes, new_attributes) ->
    Object.extend old_attributes, new_attributes

    auth = new klass
    auth.authenticate params, cb

  # Users

  #NOTE - may become deprecated
  assignUser: (user_id) ->
    return null unless user_id
    @user = new UserSession(user_id, @)
