fix 1 of X - security
fix 2 of x - security
we dont even need user-id set because we're auto detecting ip if public and allowed and user id if logged in
fix 3 of x - security we also dont need this user id field which prevents spoofing
Merge branch 'release/1.2' into dev