$where, $function, and $accumulator run js on the server, which may result in extremely DOS if the agent crafts a sufficiently bad function. We should disable by default and allow users to re-enable if they have a legitimate use case for it.