...the solution to IDORs is to authenticate each user and check authorization per object.

full stop.