One could avoid that problem by keeping track of the owner of each closure and ensuring the user is properly authenticated before calling the closure.

The code explicitly protects against that.

If access to the closures are session-specific, you'll have to hijack the session to do that.