[FEATURE] user_id is now copied into security for reports api

If the user_id in *not* in the security body, but it *is* in the
request body, copy it into the security body pre-signature generation.