implement more thoughough authorization
remove portfolio_documents_controller