ensure only logged in user can mark URL as private
add basic statistics functionality and fix some permission bugs