How do we know that the current_user has permissions for this team? Anyone can pass an arbitrary team_id in the params.