set X-USER-ID as email on Applicant creation; prevent Applicant details being returned when authenticated user is not the Applicant