Currently when checking auth, cluster find will scan the find request looking for the "term" field because hasTerm is a parameter to the find authorization logic cluster find and regular find share. Term is an internal option used within replication, so no cluster find should ever include it. We could avoid this check by either parsing the cluster find earlier so we can consult a pre-parsed IDL type instead of scanning the raw BSON, or by disallowing the term field in cluster find and assuming hasTerm is always false.