When tokens become significant for security, we should derive the `userid` from `session.user`.