fixed #243 - The method to update a single field of a document should return 403 when a user with read-only access tries to modify it
added test for #243