model.getAll accepts query, creating db with safe:false