add security perms for views