auth with rights