Documented a known bug - big deal
Differentiated the sign up and unsign up permissions

In both the backend and the frontend