Expanded Authorization to be correct criteria (user_id on expense)