update url and remove useless url, add permission classes
overridder provider to manage our own authentication