stored used id in session instead of user