fixed rights
removed server auth