Canonical routes for collection items don't ensure that the collection id is correct

Collection items have canonical routes like /collection/1/item/1, but we don't have anything that verifies that collection_item 1 belongs in collection 1. So /collection/2/item/1 would return the same collection_item, even though it isn't in collection 2.

Not sure how to implement this. Perhaps an additional _custom_access requirement on the route?