One thing not really understand. If they only check last requested id without checking if it is belong to same user session. How was the back end server know it was sent by the user?