Since x-pack is commercial for more complex scenarios how can I add security (authentication and authorization) to users? I have though of an API Gateway but this will either give full access to ES and Kibana to all authenticated users or not. What I want to achieve, is without using x-pack or another commercial plugin, to have users that can create reports and other users than can see their own reports.