How big is the user data blob you're attempting to retrieve? The fact that you can get /meta-data but not /user-data suggests that the network plumbing is functioning properly, but that the metadata service is taking so long to retrieve the user-data in question that it times out. That might suggest a problem at the database or possibly caching layer. Also, what do you see in the nova-api logs when the request is made?
