some routing stuff, some permissions stuff