Test sanitization of collections and documents.
Merge _links with links users have provided.
Use governance information of parent document for fields.
Make it harder for users to screw up permissions.