Workspace request handler may reveal documents from other users