One forgotten thing about not using user id in cookie