Why did this need to get moved? Wouldn't the request need to be authenticated before you can serialize the user id into the cookie?