Describe the bug

I have spoken to some people who faced the same problem where there user state was shared, because they just used the example from README.md. This example already states that userID is an optional parameter, however it doesn't clearly state that sharing user state is a security risk. Many people use YOUR_USER_ID as a token..

Example SO question

Could we possibly make this more clear?