prevent users from saving to docs to collections that aren't theirs