This method also needs to be able to perform api calls when there is no explicit user (e.g. when Exercises wants to call something on its own without the call being connected to any user).  Maybe there are two methods: `user_api_call` and `application_api_call` or similar.