default user only gets read access to db