store id in session, not crypted hash.
no ruby 2.0 hash syntax.