specifying bogus album or user id in query string doesn't break everything (i hope) anymore