With our document based DB backend, injection attacks are not (with some edge cases) something we need to worry about.

We do need to think about security from the point of view of privilege, however. Our permissions middleware will take care of *most* cases, but there are a few todos in that regard. 

Our contentmanager no longer tracks valid content types, for example, so it's actually possible to update a user via /api/content/user, which is not great. The permissions middleware will still prevent users that are not authorised to perform that update from doing so, though.