security fix: store user_id in session

instead of class var...excuse me i don't know what i was thinking