Post Method in Bookmarks Controller accepts User Id as argument, but Delete only allows current user to delete

[eflamm]

Since the Authorize logic can determine the id of the logged in user, why pass in user id as an argument, rather than deriving it from the access token as is done in other methods. Otherwise, one user could theoretically create bookmarks for another user, but not delete them.