Firebase security rules for multi-user data structure