permissions CRUD and some security fixes