diff --git a/src/server/middleware.coffee b/src/server/middleware.coffee
index 9b5beb09c2..47ccaad07b 100644
--- a/src/server/middleware.coffee
+++ b/src/server/middleware.coffee
@@ -19,6 +19,7 @@ module.exports.allowCrossDomain = (req, res, next) ->
   res.header "Access-Control-Allow-Methods", "OPTIONS,GET,POST,PUT,HEAD,DELETE"
   res.header "Access-Control-Allow-Headers", "Content-Type,X-Requested-With,x-api-user,x-api-key"
 
+  # wtf is this for?
   if req.method is 'OPTIONS'
     res.send(200);
   else
diff --git a/src/server/store.coffee b/src/server/store.coffee
index ad463ecbaa..b83ef268a4 100644
--- a/src/server/store.coffee
+++ b/src/server/store.coffee
@@ -70,7 +70,7 @@ userAccess = (store) ->
 ###
 REST = (store) ->
   store.query.expose "users", "withIdAndToken", (uid, token) ->
-    @byId(uid)
+    @where("id").equals(uid)
       .where('apiToken').equals(token)
       .findOne()