add default access, fix ajax change visibility