logging in doesn't need permissions