added right url to permissions