Can you switch this to req.session.user.id?