Since Manifest's Auth is RBAC, and since the IDs used for updating entities increments by 1, then doesn't that mean since a user can update their own score, then they can update everyone's score because they can guess the id by incrementing/decrementing their own ID?