require login and appropriate permissions