title: Firebase security not working
body: <p>Need help understanding what wrong with the "Tracking" rule.  I'm able to read that data even though it's marked as .read : false. </p>
  
  <pre><code>{
   "rules": {
     "User": {
        "$uid": {
          ".read":  "auth != null &amp;&amp; auth.uid == $uid",
          ".write": "auth != null &amp;&amp; auth.uid == $uid"
          }
      },
      "Purchase": {
        "$uid": {
          ".read":  "auth != null &amp;&amp; auth.uid == $uid",
          ".write": "auth != null &amp;&amp; auth.uid == $uid"
          }
      },
      "Parm": {
        ".read": true,
        ".write": false
      },
      "Tracking": {
        ".read": false,
        ".write": true
      }
    }
  }
  </code></pre>
  
  <p>This is being done on an IOS app. Here’s the code: </p>
  
  <pre><code>Firebase *ref = [FBase referenceForTrackingDeviceId:sysparm.deviceId]; 
  [ref observeSingleEventOfType:FEventTypeValue withBlock:^(FDataSnapshot *snapshot) { 
    if (snapshot.exists) { 
      DLog(@"got it"); 
    } else { 
      DLog(@"No data"); 
    } 
  }]; 
  </code></pre>
  
  <p>From the debugger: </p>
  
  <pre><code>(lldb) po ref https://&lt;My-Firebase&gt;/Tracking/E8C0C8FB-DE20-4017-9C74-3A6DAD6D4DC7 (lldb) po snapshot.exists YES
  </code></pre>