added permission handling (read only for user that didnt create)