how is `userId` different than `uid`? I'm thinking that fxa-oauth-server shouldn't need to manage its own list of users, but should instead just use fxa-auth-server's uids everywhere.