changed security to use a single global document for all users per bucket