Look for list of domains in get_document_or_404

http://manage.dimagi.com/default.asp?146548

Tested editing my own web user and the web user of a domain i was not in.
This will pass for any doc that has neither `domain` or `domains` how about
```
if (d.get('domain', None) != domain and domain not in d.get('domains', [])) or d['doc_type'] not in allowed:
    ....
````