Under the hood, I've set up a little security catch: a ServletFilter that will check to see if the given parameter name matches the name currently in session for the current user.

Yes, they are dreams to drive, but they also can catch fire, veer into ponds or impale pedestrians on their hood ornaments.