What do you mean with break the application? The cURL call would only work if the current_user is deputy or admin. 
And when he passes wrong parameters in this cURL call, he will only get an Exception. Why is that breaking our application?