test '_userId' instead of session.userId