* added permission check for secrets * typo in subresource * moved auth check to the command receiver