added security filtering for metadata, not tested
refectored permissions in a separate module