I agree `userid` should be derived from `session.user`, but if we are using the `userid` as part of the naming scheme of resources, then we should also check that `request.params.userid === session.user.id`.