Use session instead of cookie for user_id
Add controller tests