don't allow the user to spoof their userid in setting change messages

otherwise, anyone can change anyone else's settings