bugfix: unauthorized record update via wrong record id