permission management should be simple.

remove flask-principal dependency and simplify permission management.
add func to fork public chart.