don't need to do authorization rules for id=1 or id=2, profile and daily snaps