add auth and acl