only user_id is stored in session as an identity