For some routes on an API, like
GET /news, one would asume the user only wants news that pertains to them, so the userId is implicitly taken from authentication info.
However, some of the routes on an API i'm designing modify the "users" resource - i.e. changing some account info. For example, the user might want to change their name on the account. I could do
1) Is this dichotomy generally correct (correct meaning most REST APIs would be designed in this fashion)? The idea that PUT would use an explicit userId where POST would take it from authentication info
2) If yes to the above, which style makes more sense for "modifying-account-info" type routes? If no, what do you suggest?