Use lean in more places

website/server/controllers/api-v3/inbox.js

@@ -24,7 +24,7 @@ const api = {};
 api.getInboxMessages = {
   method: 'GET',
   url: '/inbox/messages',
-  middlewares: [authWithHeaders({ userFieldsToInclude: ['profile', 'contributor', 'backer', 'inbox'] })],
+  middlewares: [authWithHeaders({ leanUser: true, userFieldsToInclude: ['profile', 'contributor', 'backer', 'inbox'] })],
   async handler (req, res) {
     const { user } = res.locals;
     const { page } = req.query;

website/server/controllers/api-v3/tasks.js

@@ -388,7 +388,7 @@ api.getUserTasks = {
   method: 'GET',
   url: '/tasks/user',
   middlewares: [authWithHeaders({
-    // Some fields (including _id, preferences) are always loaded (see middlewares/auth)
+    leanUser: true,
     userFieldsToInclude: ['tasksOrder'],
   })],
   async handler (req, res) {
@@ -953,7 +953,7 @@ api.addChecklistItem = {
 api.scoreCheckListItem = {
   method: 'POST',
   url: '/tasks/:taskId/checklist/:itemId/score',
-  middlewares: [authWithHeaders()],
+  middlewares: [authWithHeaders({ leanUser: true, userFieldsToInclude: ['_id'] })],
   async handler (req, res) {
     const { user } = res.locals;
 

website/server/controllers/api-v3/user.js

@@ -406,7 +406,7 @@ api.getUserAnonymized = {
         { type: { $in: ['habit', 'daily', 'reward'] } },
       ],
     };
-    const tasks = await Tasks.Task.find(query).exec();
+    const tasks = await Tasks.Task.find(query).lean().exec();
 
     forEach(tasks, task => {
       task.text = 'task text';