If you don't scope this through the user, you'll be able to create cards for other people's decks.