authentication and permissions working better