We use AppCheck for protecting server. But we don't know if this token is shared from other users or not, because the token doesn't have any user identity who issued the token. We would like to set userID to the claims in creating AppCheckToken. And at server, we check userID in the claims.