Add correct auth rules