InstantPrizeCards: Only allow access using the /users/{user_id} path