userId field for API should accept anonymized 4 digit IDs

[kallooa]

@brianhelba There seems to be no straightforward way to find a user's 24-character userId, except by use of the old ISIC Girder platform. My proposed method of resolving this issue: allow userId field to accept 4-digit anonymized ID (i.e. XAO3), in addition to traditional 24-character userId.