Android In-App Billing - user ID in signed JSON
===

When you verify signed JSON which comes when a user has completed transaction there is obvious need to verify that this particular purchase was made by a particular user. It especially important to prevent the possibility of changing the userId when you send for example userId and signed JSON to your server for verification purposes. But there are no such fields in signed JSON. 

So is it OK to place some userId in `developerPayload` field ?


    { "nonce" : 1836535032137741465,
      "orders" :
        [{ "notificationId" : "android.test.purchased",
           "orderId" : "transactionId.android.test.purchased",
           "packageName" : "com.example.dungeons",
           "productId" : "android.test.purchased",
           "developerPayload" : "bGoa+V7g/yqDXvKRqq+JTFn4uQZbPiQJo4pf9RzJ",
           "purchaseTime" : 1290114783411,
           "purchaseState" : 0,
           "purchaseToken" : "rojeslcdyyiapnqcynkjyyjh" }]
    }