Please remember that you need to check for validity any time there is any ID in the URL. You have to check that such a resource exists in the DB