Added userId for authorizeUser()