On: Gaining access to anyones Arc browser without them...

[cutemonster]

Is there no Allow-read? Edit: Yes,

    allow read, update, delete: if request.auth != null && request.auth.uid == userId;