added permissions
updated web.js