[...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. [...] Ninja sessions are not encrypted by default. Therefore you should not store any critical information. Storing a user id, or username is fine
What makes storing the userId "fine"? The way I understood this client-side-sessions are basicly a cookie with attributes in clean text.
What prevents an attacker from just changing it's usersId in the session and therefore becoming another user (without logging in) to the server?