the idea is that getting a list of resource IDs shouldn't be a sensitive operation