BOLA, the #1 API Vulnerability: a One-Line Fix and an A-B Test in Go and PHP

Change one ID in the URL and the API returns someone else's invoice. The fix is one line; the A-B test, with two users, proves it is in place: in Go with httptest, in Symfony with a Voter and a WebTestCase.