authentication fixed, session user ID fixed