Both userId and galleryId must be provided.