profile url, permission settings