a mess commit about permission
update project model
prepare for package views
API login done