add req.session.userId back in after all, seems quite often used. I'll
revisit this