correct permission grants
test the injection of password as well