audit: add support for session ID user filter