disable publish override without force
add authorization for normal user
fix bug that star can escape authentication
check all versions in pkg, don't send diff info to client