change session.userId check.