permission management
fix auth loop