user out of users.list() doesn't have a session attached
... it should have the active call session...
at the moment if you do not set the session for every user object you will receive a null pointer for example when calling user.sendPrivateMessage()