document level security - closes #143