changed from username to userid in $_SESSION