session now takes care of user_id