Verify and enforce who should be able to edit a document

[reefdog]

Mentioned in #6:

Title editing should allow editing by an admin, in a way that captures who made the last edit*. (Uploaders are often not available to clean up their files.)

Right now the document's organizationId must match the user's id. We need to assess that and add more complexity if necessary.

*Spinning the "capture" part off into #41.