Added security checks, changed _id to id