changed user id to a cryptographically secure random hex value