As just as I hate to say it, but do we maybe need a whitelist of valid mongo $* operations? Or is "$" not valid in a key name in mongo?