(api): fixed two bugs

Two takeaways here:

1. Scoping data is annoying if you don't think about it earlier.
2. I don't like mongoose.