Use user ID instead of login token in URI; send login token using Authorization header.