UserId not sent in URI, but JWT