updated permissions and validation so you can only add your own things