Stringify _id in get-user.

When the session is stored in a cookie it must be serializeable.
ObjectId is not.
Use session cookie.