build out permissions and authentication
remove old authentication scheme