Current user is defined by access token All operations are in the context of current user so should operate on current user Unless operation specifically states another user like /users/:userId to show another user