IMHO the right thing for the view to do is take userid from the request params.  It's serving a particular resource and that resource is identified by the request URL, not the session.  Ideally the auth check would be factored out of this method and put into a prereq or some other part of the view configuration.