fixed auth permissions, added update