add validate login and permission