Protect against unknown user in iteration endpoint