add 403 to app dashboard, bug fixes to thread create