only finds user by user_id from session if one exists