would be nice to add permissions to it, links only show up if logged in, or down to the specific `hasPermission()` calls