added validation and more permission to only logged in user