resolve isuue #201

Putting in session the user email after login, lead to an issue:

If the user change his email in the typical "edit profile" page, he gets logged you because the cookie and the session couldn't verify upon the new emal and the persistant code.

I put in session the user id instead email/username.
The user id should never be editable.

see #201