Correct query so it scopes correctly
Add DoS protection to action