users are identified by userid