Tests added for api calls to support private bookmarks

user should not be passed in. The bmark model should not know how to parse out the attributes of the user object. It should just take the string.