add permission to check that the user owns the document