userid secure in redirect