fully test permissions, add ability to pass a field list of the class, so column_names will become the field list