hashed user ids (all sessions now securely hashed)