session uses userid instead of username...
bit o refactoring