commented out code that hides _id field from untrusted clientside code