try only allowing _userId subscriptions on client routes (memory leak
attempt, see see http://goo.gl/TPYIt)