scope HTTP resources by userid