working authentication over database for user listing + still need to improve permissions on different requests