add permissions for signed in user or no user