[Security] Make sure user_id in API request matches authenticated user

[vegetabill]

Currently it appears from the code that anyone can view any data by just guessing a user id. There should be code to make sure that the user_id matches the logged-in user id.

trakker/express-server/index.js

Line 22 in 3e7d46c

user_id: req.params.user_id,