Always pass list_id and prepared for checking if has permission to write
Always check if logged in