user_id is now passed in Authorization header

added a few parameterized urls for GET methods
test cases for destroy work