changed expected format of requests so userId is now passed in the querystring rather than URL path
WTF