constrain users access to only their own personal data

Regarding user access endpoints ( not related to admin/masterkey):

Correct me if I'm wrong, but it looks to me that the authentication and routing code currently has no built in mechanism for pŕeventing an authenticated user from accessing data related to other users by simply leveraging querymen to make queries that pass some other user's id ?

Hopefully I just failed to locate this, but in case it really doesn't exist, and because this is such a common requirement, it would be great to include a build-in mechanism for this so that this functionality could be activated by just adding an item or attribute ( could be named something like _requireOwnId_ or `ownerOnly` ) to a route's middleware chain.

Start by tracing the authentication and routing code for user access endpoints, then inspect how querymen-generated queries accept a user id and how route middleware is configured. Done means an opt-in mechanism prevents non-admin/masterkey users from querying another user's data, with coverage for attempts to access a different user id.

Written by the indexing model from the issue text.