Using Meteor-Files' protected hook does not provide access to @userId unless you're on localhost.

I've pinpointed the issue to the _getUser method here where the x_mtok cookie is never received by the server. The cookie is present in the browser and has the correct value, equal to Meteor.connection._lastSessionId.

Again, an emphasis on the fact that localhost actually works.

Also, @userId is present in the onBeforeUpload or onBeforeRemove hooks.