permissions work + using real URL