remove createUserId, and instead skip our protectRead function if
they're not calling a read on any user path