RequestFactory Security: prevent the user from retrieving other users content

A RF call retrieves bookings for the current user. How can I prevent the current user from opening Web Inspector, changing the userId of the RF call and retrive bookings from another user? A classic problem isn't it? :) Are there RF/GWT-specific solutions and/or best practices?

--
You received this message because you are subscribed to the Google Groups "Google Web Toolkit" group.
To view this discussion on the web visit https://groups.google.com/d/msg/google-web-toolkit/-/NCtCHvkSSEQJ.
To post to this group, send email to google-web-toolkit@googlegroups.com.
To unsubscribe from this group, send email to google-web-toolkit+unsubscribe@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/google-web-toolkit?hl=en.