"by_id" expects an integer, right, but there is no validation.