Fixed hard-coded user ID in API controllers