"Is this record mine" was written four ways, and one of them tested `rest.starts_with(me)` with no trailing `/`, so any account whose DID merely begins with yours read as you — and that reader promotes a record it believes is yours from "state unknown" to "open". `did:plc` is fixed-width so it could not bite there, but a `did:web` is as long as its domain: standing as `did:web:example.com`, a pull at `at://did:web:example.com.evil.net/...` was yours. `model::record`'s `authority_of` is the one reader now, and `resolve.rs` follows the `is_did` rule its own doc comment already claimed it followed. Change-Id: I20a52c8bd517fdc11e9955bc3f6b764986fbbad9