added some hacked-together permisison control.  see application_controller.
permissions operational