Add user token and service user id to headers

* Data was not scoped by user. Services should check for the USER-TOKEN
  and SERVICE-USER-ID headers to correctly scope user access.