Firebase now actually uses auth and security rules, list of active users aggregates itself per user