moved session user id to signed cookie