check permissions (decorator) is valid; sort distinct output client side (not server); debug stuff; pep clean-up