preventing access to document not owned by the user