Non Admin users should not be able to edit documents

[Dee Koder]

Apart from disabling routes, authentication and authorization checks must be in place. Add checks in permission.rb on user model.