resolve issue #201

Putting in session the user email after login, lead to an issue:

If the user change his email in the typical "edit profile" page, he gets logged out because the cookie and the session couldn't verify upon the new email and the persistant code.

I put in session the user id instead of email/username.
The user id should never be editable.

see #201