login rules and permission checker