When building an API in Loopback, I want to have relatively flat, authentication protected routes like: `/users`, `/orders`, etc. So, if I'm a user and I have some orders, I should be able to simply call `/orders` or `/orders/:id` to get one or more of the orders for my account.

Using Loopback's model relationships, I could do something like: `/users/:userId/orders` relatively easily, but there are definitely cases where I don't want to add in that complexity to the URL structure.

Is there a good, recommended way to do something like this? Seems like there should be a way to set this up such that the current user's access token tells Loopback which records it has access to and then can return only those.