re-define permissions. fix controllers, models.