[FIX] Use session ID for user uniqueness