Nice to have quick wins, though. Some nefarious actor could create an account, and then attempt to POST `(1..1_000_000_000_000).join(',')` as the `user_ids` parameter to this endpoint. Thinking about efficiency nips that in the bud.