modify userId to @sessionAttributes(currentUser)