implement rights and users aka. authentication