fixed security for /lists/{id} request