or possibly return data that we don't want them to see, or run a bunch of slow queries?