make document read-only before authentication