remove hidden userid field and set the user id from the current_user

Alternative to PR #85.  the user_id should be sent in the form.  This would allow someone to post feedback posing as someone else.  Instead, set the user from the current user in the session