Three auth vulnerabilities closed

Three IDOR and authorization findings from the audit were fixed.