add /init to permitAll list