Fix login only using user id

The session cookie was just storing the user id, so when I deleted all
the users, everyone was still signed in as user 4, even though user 4
had changed. Lots of problems there.