User session counters stay <= per-user limit