added entity and operation authorization control
fixed logout