I vote for solution 3 as it's the only one that seems totally safe to me.
Also, I fail to understand why 2 is unacceptable. I guess this is a question of terminology, but to me, if user_id is 0, then you are not logged in, and I think it's wrong and confusing that the Logout link appears in the header. Instead I would like to see the login link there.
