Consider how authorization is going to work. You can't trust the client!