add firebase security rules. Data is now Persona-secured.