auth: create only requires add_entry permissions