title: Meteor.userId is changeable
body: <p>Playing around with Meteor, I have found that even with the insecure package removed, the client can change the Meteor.userId function. For example,</p>
  
  <pre><code>Meteor.userId=function() {return "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"}
  </code></pre>
  
  <p>as can be done with <code>Meteor.default_connection.userId()</code> (the redirected function). How do I secure this?</p>