user session auth fix

Should check that session[:user_id] == user_id