add changeLog subdocument model; add user-session middleware; remove data metadata from models as this is contained in document objectIDs and changeLog objectIDs