fix read only bug in formFields function
first commit
add getUserId function
fix session security