use user_id in session on ajax cuz redirecting to login won't help