Fixing security issues with disallowed mongoose fields