I'm concerned about the lack of authentication on this API. What's to prevent an attacker from modifying my booleans? just his ability to guess the guid?