filled in doc.py and contact.py

Maybe a point of confusion:  The Auth token authenticates the current user, say Sydney.  
When Sydney wants to add a new contact, Sydney authenticates with her auth token, but includes contact information for her contact in the json.  

In other words, the Authorization header is only for the current user / author, not the identity of the contact / recipient.