How on earth are these guys going to prevent a user from reading all the credit cards from that couch-db via its json interface?