a working infinite scroll for user! (mostly for reference, we're not crazy enough to let something this insecure to go to production)