protect actions with public access; make permission optional