This is a tricky part, and I'd like your thoughts. The API is stateless... but as we discussed, which user owns a Programmer is really an implementation detail - it's not something we expose in the API nor something we expect the user to decide. We could change this, but that's how it is now.

So, in the API, should we (assuming we have authentication working) automatically look up the User associated with the access token and use it as the "owner" of the programmer? That seems to be what I want from a functional perspective (i.e. a client can use the API to create programmers, which are then associated with that client). OR, should we force the user to pass the id of the user when creating a Programmer?

I feel like I'm *wanting* to make the API a bit more stateful, which I don't intend - I'm slipping in that direction based on how I imagine the API working. Later, if I wanted to see *my* programmers, the stateful way would be to go to (for example) "/me/programmers". The correct way would be to do something more like "/users/5/programmers".

What do you think?