If someone does an authz check with a userId of "dummy" I think this will throw a ArrayOutOfBoundsException with the substring.