if current_user.id != req.params.user_id:
    // Send response status 403
else
    // Send response 200 with items as the body