Never trust a client-supplied tenant ID

A common authorization bug: the API takes tenant_id from the request body or query string, then loads...