[firebase] force thread and module namespacing

[sloane-shark]

We should enforce that any modules that try to access firebase only have access to the calling threadID and module document. For example, if someone in threadID=1 access the preferences module, that instance should only have access to /1/preferences in the firebase DB. We will probably want some whitelisted exceptions explicitly provided in firebase.js, like giving all modules access to a threads general preferences.

[kedarv]

I think this is already being done to some extent

[sloane-shark]

well its done by convention, but my intention here was to actually force modules to do it somehow. idk if thats feasible.