api: validate user_id which is really matched to user