Exercise 3: What Changed Between Chapter 8 and Chapter 9 — Possible Solution
====================================================================

WHY A STRANGER COULD HAVE EDITED IT MONTHS AGO
------------------------------
Per this chapter and Chapter 8's own warn-box, update_page_title was built in Chapter 8 with deliberately no permission or login check at all - anyone who knew or guessed the correct URL could rename any page on the site at that point, since the view itself never checked who was making the request.

WHAT SPECIFICALLY CHANGED IN CHAPTER 9
------------------------------
Per this chapter, Chapter 9 added the @staff_member_required decorator directly onto update_page_title - one line, requiring a logged-in staff account before the view's own logic runs at all. This is the same view, completely unchanged in its own internal logic, now genuinely protected because of that one added decorator.

WHY TODAY IS DIFFERENT
------------------------------
Per this chapter's own Step 6, Sam can still use update_page_title today because Sam is logged in as a real staff account (Chapter 9's own bcrypt-matched admin), but an anonymous stranger attempting the exact same request now would be rejected by @staff_member_required before ever reaching the code that actually changes the title - the gap that existed from Chapter 8 through the start of Chapter 9 no longer exists.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly identifies that Chapter 8 left the view completely unprotected, correctly names @staff_member_required as the specific one-line change Chapter 9 made, and correctly explains why that decorator is what distinguishes Sam's legitimate use today from what any anonymous visitor could have done before it existed.