fix(api): multiple userID binding on user create token

The `CreateUserToken` handler will now accept the user ID either in the
parameters or the header, with preference given to the header when both
are provided.

api/routes/auth.go

@@ -197,11 +197,6 @@ func (h *Handler) CreateUserToken(c gateway.Context) error {
 		return err
 	}
 
-	// If the tenant id is not in the parameters, we get it from the header.
-	if req.TenantID == "" {
-		req.TenantID = c.Request().Header.Get("X-Tenant-ID")
-	}
-
 	if err := c.Validate(req); err != nil {
 		return err
 	}

pkg/api/requests/auth.go

@@ -11,6 +11,6 @@ type AuthTokenSwap struct {
 }
 
 type CreateUserToken struct {
-	UserID   string `header:"X-ID" validate:"required"`
+	UserID   string `param:"id" header:"X-ID" validate:"required"`
 	TenantID string `param:"tenant" validate:"omitempty,uuid"`
 }