Security update

- changed to user id instead of access token