dont store userId in cookie