authorization default in sql_references() (for the time being)
order of content
need people_id in priv query
more priv checks