ensure authorized data access

[timoweiss]

To ensure no unauthorized data access we need to attach the requesters user_id to the service queries.
This is, of course, not for each action required.
To keep the api of the services consistent, we should define one property name:

• requester_id, requesterId
• requesting_user, requestingUser
• asker :D
• ...

pls propose/vote @locator-kn/backend

eg. verify that requesting user is part of conversation (get conversation by id):

// given datastructure
{
    _id: ObjectId('abcbcaabc'),
   participants: [{user_id: 'user1', last_read: 0}, {user_id: 'user2', last_read: 0}]
}
// resulting query
collection.find({_id: new ObjectId(conversation_id), 'participants.user_id': requestingUser})