refreshed with latest firebase security rules