fix a hmac bug
add permission check logic for api