[rules-users] Auditing for stateless session