user id only stored in session