add permission, workaround: accounts.can_view