As part of making our API Catalogue visible to the public, we have discovered that Anonymous users can vote for API Backends. Disable anonymous votes by adding an allow check for Meteor.userId(), and possibly adding a schema to validate API Backend votes.