change auth address
Add user model for authorisation checks.
proper check if user is owner of document for update calls.