add 'auth.user_logged' permission