racer #37 still an issue

src/server/store.coffee

@@ -14,14 +14,15 @@ module.exports.customAccessControl = (store) ->
 userAccess = (store) ->
 
   store.readPathAccess "users.*", -> # captures, next) ->
-    #return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
-    uid = arguments[0]
     next = arguments[arguments.length - 1]
+    return next(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
+    uid = arguments[0]
     next (uid is @session.userId) or @session.req?._isServer
 
   store.writeAccess "*", "users.*", -> # captures, value, next) ->
-    #return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
-    [captures, next] = [arguments[0].split('.'), arguments[arguments.length-1]]
+    next = arguments[arguments.length-1]
+    return next(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
+    captures = arguments[0].split('.')
     uid = captures.shift()
     attrPath = captures.join('.') # new array shifted left, after shift() was run
 
@@ -36,14 +37,14 @@ userAccess = (store) ->
     next(false)
 
   store.writeAccess "*", "users.*.balance", (id, newBalance, next) ->
-    #return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
+    return next(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
     oldBalance = @session.req._racerModel?.get("users.#{id}.balance") || 0
     purchasingSomethingOnClient = newBalance < oldBalance
     next(purchasingSomethingOnClient or @session.req?._isServer)
 
   store.writeAccess "*", "users.*.flags.ads", -> # captures, value, next ->
-    #return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
     next = arguments[arguments.length - 1]
+    return next(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
     next(@session.req?._isServer)
 
 
@@ -58,7 +59,7 @@ REST = (store) ->
       .limit(1)
 
   store.queryAccess "users", "withIdAndToken", (id, apiToken, next) ->
-    #return next(false) unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
+    return next(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
     next(true) # only user has id & token