API calls must use authentication

[cesar-circle]

userId should not be part of the URL (as it is visible in the request log) and must be passed with authentication info