forgot to add settings.py update in last commit - now actually update default permissions to just IsAuthenticated