moved guest permissions into config.py