Ensure authentication on every API call
Pass userId in the header