Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.
