fine tuned web permissions [close #553]