Only public user fields in unauthorized requests

A hook added to inject current user_id to request.
dbapi updated to handle public fields.

Change-Id: I2419e4fe20e571e5542b0dc5b89b80723fde3cca