server-side authentication

[Sovamorco]

We should not pass user id as part of a request, instead we should separately authenticate each request server-side