Yeah, and that's why I took interest in those. The only reason this is secure is because the queryset used in the resource uses `filter(user=request.amo_user)` ; the authorization class used is the default one, which allows everyone.

It could be switched to be a 403, but the good thing with the current implementation is, it doesn't disclose the existence of accounts outside your own ; non-existing ids or ids of accounts belonging to other people return 404 indiscriminately.