allow entering city or updateCity without permission checks