use X-USER-ID header to authenticate