change permission; add header