Remove user id from path and use signed in user instead