Security issue with User-Restricted Resource Access

I found a security issue, the query should be updated with the <code>auth_username_field</code> even when a GET with no parameters is performed, a user should only see the items he created.

The fix works for me. Keep me updated !