I am concerned that a bare-except here could be hiding some errors. If the request has a user, but not pk (can that happen?) then we should log an error (to the normal application logs). If there is no user, then it makes sense to have `user_id = ''`