title: Parse Server Session Token Security Issue
body: <p>I am creating a vue-single page application based on parse-server entirely and using its' javascript sdk for data manipulation in client end. For logging in/signing up i am using Parse.User.logIn/signUp and using the javascript key for authentication. </p>
  
  <p>Now after logging in the browser is sending rest api request to parse-server with installationId and sessionToken. Which is alright but what if any user decides to create a bot to fill up the parse-server with garbage data? I checked that using/copying these security tokens/keys i can create objects easily by sending rest api request to parse server. I can prevent Class creation but how to prevent reusing session tokens from other medium?</p>