allow `_id` field in query