Database authentication rules

[nikeshnazareth]

We should limit read/write access to the database in general. Also, the docs created by the cloud functions (eg. leaderboard) should be read only