Add a new SessionData collection and limit user fields

* Add new SessionData collection to store user session data available to
server and client
* Limit the Users fields sent to the client by `myCards`, `dueCards`,
`brokenCards`, and `globalSearch` using new `Users.safeFields`
* clean-up

models/users.js

@@ -377,6 +377,14 @@ Users.initEasySearch(searchInFields, {
   returnFields: [...searchInFields, 'profile.avatarUrl'],
 });
 
+Users.safeFields = {
+  _id: 1,
+  username: 1,
+  'profile.fullname': 1,
+  'profile.avatarUrl': 1,
+  'profile.initials': 1,
+};
+
 if (Meteor.isClient) {
   Users.helpers({
     isBoardMember() {