add simple user permission and restrict category creation to admin