use user id from session