I think this would be safer to be written as

``` javascript
if (tokenData.svr === 'yes') {
  uid = req.params.userid;
} else {
  uid = tokenData.usr;
}
```

The reasoning is that there is a wider domain of values for tokenData.svr to fail the if check than to succeed it.  If svr happens to be "undefined" or something, the current code will default to using the uid from the request, where I'd prefer to default to using the uid from the token.

I.e. there's only one way to use the uid from the request, everything else uses the one from the token?