Use stored documents for controller actions

Controller actions reload the document from the database and check read access first, instead of trusting a copy sent by the browser.