restricts documents to active users' ones