Changed CurrentUser method to check against the user's id AND SessionToken