session: userName -> userId