Verify the response only contains data from requester account.

We have logic at each route to get the account of the requester and use that in the query to retrieve data. This is good, but we'd like to add an additional level of security to verify the response does not contain any items associated with a different account, before returning it to the client. It would make most sense if this was done as some type of middleware and was not required to be implemented at each route.

首先，追蹤每個 route 中現有的 requester account 查找與 query 流程。調查 middleware 入口點與回應路徑，然後定義在資料到達用戶端之前如何驗證 account 所有權；完成的標準是回應中不包含任何與其他 account 關聯的項目。

由索引模型根據 Issue 內容生成。