non-REST stuff separated to another packages and restructured code; added permissions