Authorize Can't See Your Data

The first authorization bug I ever shipped wasn't a missing [Authorize] attribute. It was the...