Just to put my mind at ease: can you add a test or two that make sure users can't do nefarious things through the API, e.g., do a get against '/api/collections/tasks/../tasks/some_os' and against '/api/collections/tasks/../../../../../../../../../etc/hosts' ? Both should produce pretty loud errors