update cloud functions to ensure the user's identity

[Aurelien9Code]

For now, everyone can send any userId to the Cloud functions. Their uid should be tokenized before calling the cloud functions.