title: Routing security flaw in Angular/MEAN.io?
body: <p>I just installed the MEAN stack (MongoDB, Express.js, AngularJS, Node.js) and opened up the example program (as found on mean.io) and they have a basic app that you can login to and create blog "articles" just for testing and such.</p>
  
  <p>Anyway, I removed the '#!' from the URL and it outputted the entire user and article models as they are in the database. It seams as though doing that made it stop routing through Angular and instead used the Express routes which are just JSON REST apis. Is this a flaw in the MEAN stack package, Angular as a whole, or maybe just a development environment setting? I can't imagine that this would be released with a huge flaw like that but maybe I'm just missing something..</p>
  
  <p>Replicateable steps: </p>
  
  <ul>
  <li>Follow installation instructions on <a href="http://mean.io" rel="nofollow">http://mean.io</a></li>
  <li>Goto your local app in the browser and create an account and login</li>
  <li>Create an article</li>
  <li>View the article item you just created and remove the #!/ from the URL, you then see the JSON object of your logged in user account
  complete with hashed password and salt, as well as the article
  object.</li>
  </ul>