Be more serious about security

* check users inputs on the servers
* add a few `if Meteor.userId()`
* update packages
* fix indentation