update playlist model and controller, change permission to privatre