Updated index.js

[sohamdodia]

Added extra security layer. UserId needs to be passed as id in headers along with the token in order to verify the request comes from the same source. Decoded jwt token is matched against userid which is passed in headers to make sure that if the jwt token intercepted by some third party it must not be able to use the token to manipulate other users data.

[fbartho]

Whoops! didn't mean to resurrect an ancient PR, sorry!