bug-fixing: access control, webvars