added user auth and custom permissions