userId is very easy to guess. To login as another user, I can simply iterate through integers.  Better to encrypt this or use the session cookie.