google app engine - GAE ndb security issue? -

I have two fake users who are with Sam and related ID 117138609372751079516 and 144229817858159123282.

The app has the following unit:

  class mccenti (NDB model): ownerId = ndb.StringProperty (default = users.get_current_user). User_id ())   
 When both are logged at the same time and either the user first saves the entity, property 'owner income' randomly  User ID with either : 117138609372751079516 or 144229817858159123282  
 Using a pre_put_hook problem is resolving:  
  def _pre_put_hook (auto): If not self.ownerId: self.ownerId = users.get_current_user () User_id ()   
 I have solved my immediate problem, but why is this happening in the first place? It has also been tested in development and production with a group of about 50 testers. 40% of them can see the institutions which were not theirs.  
 
 The problem is likely to be by default, the value of  owner ID  is only < Em> first  is being set, when every app engine is created for class runtime instance  MockEntity  so when a new app engine loads the example, then the default user in Python interpreter The class is set by the user to load first.  
 See this classic problem in Python and for clarification of the same condition in NDB.