Maybe we should add a check to see if the userToken is a string,
```js
  if (userToken !== ''+userToken) {
    throw new Meteor.Error(400, 'Bad Request');
  }
```