Use actual user ID as `session.userId`