https://justice-reaper.github.io/posts/Access-Control-Lab-6/
User ID controlled by request parameter, with unpredictable user IDs - Justice-Reaper