set userId on server instead of client to ensure right information