multitenant

never let an unscoped Model.all accidentally leak data to an unintended audience.