Don't trust `userid` received from server