Fix session update security vulnerability
Fix session update security vulnerability

Since we weren't checking the userId on the old session, people would
have been able to update someone else's session and set themselves as
the user for that session.

jacksonic/vjlofvhjfgm,foam-framework/foam2,foam-framework/foam2,foam-framework/foam2,foam-framework/foam2,jacksonic/vjlofvhjfgm,foam-framework/foam2,jacksonic/vjlofvhjfgm