Only use current user id if present.
Allow app-level authentication requirement.