I removed the tokens from the database calls. They are used to filter results by API client. What we can do instead is supplying a API Client unique collection as parameter to the Mongo database so clients are unable to access each-others data, what are your thoughts on this?