Added the option to specify criteria on findOne

* Added the option to specify criteria on findOne

I needed a way to check if the record being fetched is one that belongs to the authenticated user. After this PR, for request `/thread/123` I can set a where, of type or, recipient = req.sessions.user, author = req.session.user. This is useful as it allows you to have less queries, and more specifically decide if you want the record with specified ID.

For my specific problem, I'd rather have something like outgoing policies, to check if the data is allowed to be fetched. Either way, I think this functionality is pretty useful.