Reading the docs, I'm confused how this is secured. For example, if I have a table UserOrders (UserId, OrderId, Foo), how do I ensure the backend is only returning records for the current user?