auth and permissions added