permissions works for /videos