removing hidden field from the add reading button

adds a level of security that prevents altering user id param