MONGO_QUERY_BLACKLIST to disable query operators.

Allows to blacklist mongo query operators that should not be allowed in
resource queries ('?where='). Defaults to ['$where', '$regex']. Mongo
Javascript operators are disabled by default as they might be used as
vectors for injection attacks. Javascript queries also tend to be slow and
generally can be easily replaced with the (very rich) Mongo query dialect.