Mmm, since the uid is passed in as a user param i'm treating it as dangerous unless validated.