 _ = require 'lodash'
+mask = require 'json-mask'
 Band = require '../models/band'
 Vote = require '../models/vote'
 
+WHITELIST = [
+  '_id'
+  'name'
+  'parent'
+  'vote_count'
+  'userHasVotedFor'
+].join(',')
+
+# removes data that shouldn't be returned in json
+partialResponse = (json) ->
+  mask(json, WHITELIST)
+
+# returns ip address
 getIpAddress = (ipObj) ->
   if ipObj?
     ipObj.clientIp

  Band.find().populate(pop).sort(vote_count: 'descending', name: 'ascending').exec(
    (err, result) ->
      return res.status(500).json error: err if err?
      return res.status(200).json result
  )

# GET /api/bands

      # this is really hacky; should be better way
      result1.children = [result2._id]
      result1.userHasVotedOn = true
      return res.status(200).json partialResponse(result1)

# POST /api/bands/:id/vote
exports.vote = (req, res) ->
