change to socket.io, add student permission, opt some db access