Changes made to make this more secure then only account_id injection... the user must know the userid from the related account to make the injection... We need to think how block this.