user permission code is added so that app can publish on behalf of user, see index.jsp page