I am using the code below, it works. Is this the right implementation? Can someone fake their user ids by editing cookies etc.?
require('src/XF.php');
\XF::start('/hc');
$app = \XF::setupApp('XF\Pub\App');
$s = $app->session();
$uid = $s->get('userId');
if ($uid){
$finder =...