current user id is saved in session hash