refactored user capabilities in mongodb