completed fix for reading _session.user.id correctly