URL gets random user id after user is masqueraded