this is so one-off notifications can be tied to a user (jobs have a created_by, and api notifications don't make sense to have one)