One could avoid that problem by keeping track of the owner of each closure and ensuring the user is properly authenticated before calling the closure.