access control, avatars, and faker