no need to send the user.id, its already saved in the session