Previously we were assuming only 1 was requested, now properly handling multiple UIDs in a single request and not all of them being returned (eg ACL or doesn't match filters)