update TODOs
update config to require no permissions