Now use the userId as passed up from the client instead via HTTP header of the request body