The id's as unique user id's are currently not secure. You can impersonate any other id by changing the value in local storage in the browser. If you have logs see 5f2860 and fb86f7