improvements on permission rules, more tests and api-auth url fix