fix validates, permission form and abilities