save working, tested for admin, permissions require some thought