[BUG] - Security issue with using firebase functions

[zvikarp]

The security issue
When a user uses a firesbase function (e.g. changing his name) there is no check that it is him.
This can be a big problem because we use firebase functions for admin only functions (sending messages).

How to fix

1. generate a token for user and sending it to the function.
2. function checks the token and validates it.
3. function gets uid from the function and uses it. not a uid passed to it.
4. if needed, check in firestore if user has specific role.

This issue is in the following functions:

• changeName
• changeUserStatus
• sendMessage (in the near future...)
• changeUserRoles(in the near future...)