implement scope/userid checking on requests