no need to store user_id in session