you should be checking the user can edit the doc, after all