adding permissions and login to browsable api