Show users should also be protected by signature and API key verification.