Fix fatal security flaw enabling unauthenticated users to view documents