Prevent overriding user IDs in HTTP requests

The "creator_user_id" should be set by the server and only the server. Thus this
attribute has been removed from most *Request classes.