Every encrypted field in the database either has an associated userId AAD or it doesn't.  The service configuration doesn't because it's not associated with a particular user.  Pending credentials doesn't because we don't know who the user is yet.  Tokens in the user document in the database always do because we know who the user is.

`pinEncryptedFieldsToUser` adds the userId AAD because it's converting pending credentials to the service data stored in the user document.  But we never have a case where a field in the database at one time doesn't have a userId AAD and then later does have one.