update

added user functionality, so you need permission to do things