added userId to session on authenticate