A developer designs a REST API for a social platform. Users can follow each other. DELETE /api/follows/{id} removes a follow relationship. A logged-in user submits DELETE /api/follows/789. The API must check what before performing the deletion?

• A.That the DELETE request carries a valid CSRF token (the API compares it with the cookie value), and that the follow ID 789 falls inside the allowed numeric range for the table. Ownership is irrelevant once the session proves the user is logged in to the endpoint, with the follow ID itself regarded public data
• B.That the target user (the followed account) approved the request first, and that the follower count stays above zero after the deletion. The API must hold the row lock on the follows table until the transaction commits, to keep the counters accurate for the profile page of the followed account
• C.That the authenticated user is the owner of follow relationship 789 (i.e., they are the follower, not the followed, and they created this specific relationship). An attacker could submit DELETE for any follow ID - the API must verify object ownership before any destructive operation