I don't think this is correct for what we want to do. The username is available in the matchdict in the case that we're not defaulting to the user that is logged in. The api url would be /username/bmark/hash_id I believe.

So I'd say that we just respect the username from the request.matchdict (rdict in this case)

I don't think it's ever valid to get a bookmark based on hash_id alone as multiple people are able to bookmark a single url.