Don't let the user set the userId

Use Meteor.userId instead of the one being set in the form...  Security hole.