There should be validation for only readable hostid and graphid in Monitoring -> Dashboard URL.

Steps to reproduce:
1. Open Monitoring -> Dashboard with dynamic graph widget.
2. Select any host from top right select box.
3. Modify hostid value in URL to nonexisting host id.
Result: Dashboard is opened with 'all' hosts selected
Expected: Error message: "Access denied"

Example: Monitoring -> Web