Check the referenced document, not the one that names it

Fixes five permission-check defects where endpoints read/wrote a second document without validating access.