9.2.2 - test cases to ensure users can only update their own profiles
section 9.2 - finished friendly forwarding using kind of "server-side session cookies"