Authenticated folder manipulation via unchecked AJAX handlers

Missing authorization in WP Docs 2.2.8 and earlier allows remote authenticated users to create or delete document folders via AJAX. The wpdocs_create_folder and wpdocs_delete_folder handlers validate a nonce but omit the manage_options capability check before changing folder records. Subscriber-level access and a valid plugin nonce are sufficient to alter or remove the document hierarchy, without direct file upload or code execution.