Security issue with User-Restricted Resource Access

I found a security issue, the query should be updated with the auth_username_field even when a GET with no parameters is performed, a user should only see the items he created.