diff --git a/VERSION b/VERSION
index 75900061..bc7f4e66 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-Version 2.4.7-stable+timestamp.2013.05.31.11.25.20
+Version 2.4.7-stable+timestamp.2013.05.31.21.28.39
diff --git a/applications/admin/controllers/appadmin.py b/applications/admin/controllers/appadmin.py
index 08491195..b5f77401 100644
--- a/applications/admin/controllers/appadmin.py
+++ b/applications/admin/controllers/appadmin.py
@@ -37,14 +37,21 @@ if request.env.http_x_forwarded_for or request.is_https:
 elif (remote_addr not in hosts) and (remote_addr != "127.0.0.1"):
     raise HTTP(200, T('appadmin is disabled because insecure channel'))
 
-if (request.application == 'admin' and not session.authorized) or \
-        (request.application != 'admin' and not gluon.fileutils.check_credentials(request)):
+if request.function in ('auth_manage','manage') and 'auth' in globals():
+    if not auth.has_membership(auth.settings.manager_group_id):
+        raise HTTP(404)
+    menu = False
+elif (request.application == 'admin' and not session.authorized) or \
+        (request.application != 'admin' and not gluon.fileutils.check_credentials(request)):    
     redirect(URL('admin', 'default', 'index',
                  vars=dict(send=URL(args=request.args, vars=request.vars))))
+else:
+    menu = True
 
 ignore_rw = True
 response.view = 'appadmin.html'
-response.menu = [[T('design'), False, URL('admin', 'default', 'design',
+if menu:
+    response.menu = [[T('design'), False, URL('admin', 'default', 'design',
                  args=[request.application])], [T('db'), False,
                  URL('index')], [T('state'), False,
                  URL('state')], [T('cache'), False,
@@ -573,3 +580,35 @@ def bg_graph_model():
 
 def graph_model():    
     return dict(databases=databases, pgv=pgv)
+
+def auth_manage():
+    tablename = request.args(0)
+    if not tablename or not tablename in auth.db.tables:
+        return dict()
+    table = auth.db[tablename]
+    formname = '%s_grid' % tablename
+    if tablename == auth.settings.table_user_name:
+        auth.settings.table_user._plural = T('Users')
+        auth.settings.table_membership._plural = T('Roles')
+        auth.settings.table_membership._id.readable = False
+        auth.settings.table_membership.user_id.label = T('User')
+        auth.settings.table_membership.group_id.label = T('Role')
+        grid = SQLFORM.smartgrid(table, args=request.args[:1], user_signature=True,
+                                 linked_tables=[auth.settings.table_membership_name],
+                                 maxtextlength=1000, formname=formname)
+    else:
+        table._id.readable = False
+        auth.settings.table_permission.group_id.label = T('Role')
+        auth.settings.table_permission.name.label = T('Permission')
+        orderby = 'role' if table == auth.settings.table_group_name else 'group_id'
+        grid = SQLFORM.grid(table, args=request.args[:1], orderby=table[orderby],
+                            user_signature=True, maxtextlength=1000, formname=formname)    
+    return grid if request.extension=='load' else dict(grid=grid)
+
+def manage():
+    tablename = request.args(0)
+    if tablename in auth.db.tables:
+        grid = SQLFORM.smartgrid(auth.db[tablename], args=request.args[:1])
+    else:
+        return dict()
+    return grid if request.extension=='load' else dict(grid=grid)
diff --git a/applications/admin/views/appadmin.html b/applications/admin/views/appadmin.html
index 95c60ecf..2fe1817b 100644
--- a/applications/admin/views/appadmin.html
+++ b/applications/admin/views/appadmin.html
@@ -247,3 +247,39 @@
     {{=IMG(_src=URL('appadmin', 'bg_graph_model'))}}
   {{pass}}
 {{pass}}
+
+{{if request.function == 'auth_manage':}}
+<h2>{{=T('Manage Access Control')}}</h2>
+<ul class="nav nav-tabs">
+  <li class="active"><a href="#users" data-toggle="tab">Users</a></li>
+  <li><a href="#roles" data-toggle="tab">Roles</a></li>
+  <li><a href="#permissions" data-toggle="tab">Permissions</a></li>
+</ul>
+
+<div class="tab-content">
+  <div class="tab-pane active" id="users">
+    {{=LOAD(f='auth_manage.load', args=auth.settings.table_user_name,ajax=True)}}
+  </div>
+  <div class="tab-pane" id="roles">
+    {{=LOAD(f='auth_manage.load', args=auth.settings.table_group_name,ajax=True)}}
+  </div>
+  <div class="tab-pane" id="permissions">
+    {{=LOAD(f='auth_manage.load', args=auth.settings.table_permission_name,ajax=True)}}
+  </div>
+</div>
+{{elif request.function == 'manage':}}
+<h2>{{=T('Manage Access Control')}}</h2>
+<ul class="nav nav-tabs">
+  {{for k,tablename in enumerate(auth.db.tables):}}
+  <li><a href="#table-{{=tablename}}" data-toggle="tab">{{=tablename}}</a></li>
+  {{pass}}
+</ul>
+
+<div class="tab-content">
+  {{for tablename in auth.db.tables:}}
+  <div class="tab-pane" id="table-{{=tablename}}">
+    {{=LOAD(f='manage.load', args=tablename,ajax=True)}}
+  </div>
+  {{pass}}
+</div>
+{{pass}}
diff --git a/applications/examples/controllers/appadmin.py b/applications/examples/controllers/appadmin.py
index 08491195..b5f77401 100644
--- a/applications/examples/controllers/appadmin.py
+++ b/applications/examples/controllers/appadmin.py
@@ -37,14 +37,21 @@ if request.env.http_x_forwarded_for or request.is_https:
 elif (remote_addr not in hosts) and (remote_addr != "127.0.0.1"):
     raise HTTP(200, T('appadmin is disabled because insecure channel'))
 
-if (request.application == 'admin' and not session.authorized) or \
-        (request.application != 'admin' and not gluon.fileutils.check_credentials(request)):
+if request.function in ('auth_manage','manage') and 'auth' in globals():
+    if not auth.has_membership(auth.settings.manager_group_id):
+        raise HTTP(404)
+    menu = False
+elif (request.application == 'admin' and not session.authorized) or \
+        (request.application != 'admin' and not gluon.fileutils.check_credentials(request)):    
     redirect(URL('admin', 'default', 'index',
                  vars=dict(send=URL(args=request.args, vars=request.vars))))
+else:
+    menu = True
 
 ignore_rw = True
 response.view = 'appadmin.html'
-response.menu = [[T('design'), False, URL('admin', 'default', 'design',
+if menu:
+    response.menu = [[T('design'), False, URL('admin', 'default', 'design',
                  args=[request.application])], [T('db'), False,
                  URL('index')], [T('state'), False,
                  URL('state')], [T('cache'), False,
@@ -573,3 +580,35 @@ def bg_graph_model():
 
 def graph_model():    
     return dict(databases=databases, pgv=pgv)
+
+def auth_manage():
+    tablename = request.args(0)
+    if not tablename or not tablename in auth.db.tables:
+        return dict()
+    table = auth.db[tablename]
+    formname = '%s_grid' % tablename
+    if tablename == auth.settings.table_user_name:
+        auth.settings.table_user._plural = T('Users')
+        auth.settings.table_membership._plural = T('Roles')
+        auth.settings.table_membership._id.readable = False
+        auth.settings.table_membership.user_id.label = T('User')
+        auth.settings.table_membership.group_id.label = T('Role')
+        grid = SQLFORM.smartgrid(table, args=request.args[:1], user_signature=True,
+                                 linked_tables=[auth.settings.table_membership_name],
+                                 maxtextlength=1000, formname=formname)
+    else:
+        table._id.readable = False
+        auth.settings.table_permission.group_id.label = T('Role')
+        auth.settings.table_permission.name.label = T('Permission')
+        orderby = 'role' if table == auth.settings.table_group_name else 'group_id'
+        grid = SQLFORM.grid(table, args=request.args[:1], orderby=table[orderby],
+                            user_signature=True, maxtextlength=1000, formname=formname)    
+    return grid if request.extension=='load' else dict(grid=grid)
+
+def manage():
+    tablename = request.args(0)
+    if tablename in auth.db.tables:
+        grid = SQLFORM.smartgrid(auth.db[tablename], args=request.args[:1])
+    else:
+        return dict()
+    return grid if request.extension=='load' else dict(grid=grid)
diff --git a/applications/examples/views/appadmin.html b/applications/examples/views/appadmin.html
index 95c60ecf..2fe1817b 100644
--- a/applications/examples/views/appadmin.html
+++ b/applications/examples/views/appadmin.html
@@ -247,3 +247,39 @@
     {{=IMG(_src=URL('appadmin', 'bg_graph_model'))}}
   {{pass}}
 {{pass}}
+
+{{if request.function == 'auth_manage':}}
+<h2>{{=T('Manage Access Control')}}</h2>
+<ul class="nav nav-tabs">
+  <li class="active"><a href="#users" data-toggle="tab">Users</a></li>
+  <li><a href="#roles" data-toggle="tab">Roles</a></li>
+  <li><a href="#permissions" data-toggle="tab">Permissions</a></li>
+</ul>
+
+<div class="tab-content">
+  <div class="tab-pane active" id="users">
+    {{=LOAD(f='auth_manage.load', args=auth.settings.table_user_name,ajax=True)}}
+  </div>
+  <div class="tab-pane" id="roles">
+    {{=LOAD(f='auth_manage.load', args=auth.settings.table_group_name,ajax=True)}}
+  </div>
+  <div class="tab-pane" id="permissions">
+    {{=LOAD(f='auth_manage.load', args=auth.settings.table_permission_name,ajax=True)}}
+  </div>
+</div>
+{{elif request.function == 'manage':}}
+<h2>{{=T('Manage Access Control')}}</h2>
+<ul class="nav nav-tabs">
+  {{for k,tablename in enumerate(auth.db.tables):}}
+  <li><a href="#table-{{=tablename}}" data-toggle="tab">{{=tablename}}</a></li>
+  {{pass}}
+</ul>
+
+<div class="tab-content">
+  {{for tablename in auth.db.tables:}}
+  <div class="tab-pane" id="table-{{=tablename}}">
+    {{=LOAD(f='manage.load', args=tablename,ajax=True)}}
+  </div>
+  {{pass}}
+</div>
+{{pass}}
diff --git a/applications/welcome/controllers/appadmin.py b/applications/welcome/controllers/appadmin.py
index 08491195..b5f77401 100644
--- a/applications/welcome/controllers/appadmin.py
+++ b/applications/welcome/controllers/appadmin.py
@@ -37,14 +37,21 @@ if request.env.http_x_forwarded_for or request.is_https:
 elif (remote_addr not in hosts) and (remote_addr != "127.0.0.1"):
     raise HTTP(200, T('appadmin is disabled because insecure channel'))
 
-if (request.application == 'admin' and not session.authorized) or \
-        (request.application != 'admin' and not gluon.fileutils.check_credentials(request)):
+if request.function in ('auth_manage','manage') and 'auth' in globals():
+    if not auth.has_membership(auth.settings.manager_group_id):
+        raise HTTP(404)
+    menu = False
+elif (request.application == 'admin' and not session.authorized) or \
+        (request.application != 'admin' and not gluon.fileutils.check_credentials(request)):    
     redirect(URL('admin', 'default', 'index',
                  vars=dict(send=URL(args=request.args, vars=request.vars))))
+else:
+    menu = True
 
 ignore_rw = True
 response.view = 'appadmin.html'
-response.menu = [[T('design'), False, URL('admin', 'default', 'design',
+if menu:
+    response.menu = [[T('design'), False, URL('admin', 'default', 'design',
                  args=[request.application])], [T('db'), False,
                  URL('index')], [T('state'), False,
                  URL('state')], [T('cache'), False,
@@ -573,3 +580,35 @@ def bg_graph_model():
 
 def graph_model():    
     return dict(databases=databases, pgv=pgv)
+
+def auth_manage():
+    tablename = request.args(0)
+    if not tablename or not tablename in auth.db.tables:
+        return dict()
+    table = auth.db[tablename]
+    formname = '%s_grid' % tablename
+    if tablename == auth.settings.table_user_name:
+        auth.settings.table_user._plural = T('Users')
+        auth.settings.table_membership._plural = T('Roles')
+        auth.settings.table_membership._id.readable = False
+        auth.settings.table_membership.user_id.label = T('User')
+        auth.settings.table_membership.group_id.label = T('Role')
+        grid = SQLFORM.smartgrid(table, args=request.args[:1], user_signature=True,
+                                 linked_tables=[auth.settings.table_membership_name],
+                                 maxtextlength=1000, formname=formname)
+    else:
+        table._id.readable = False
+        auth.settings.table_permission.group_id.label = T('Role')
+        auth.settings.table_permission.name.label = T('Permission')
+        orderby = 'role' if table == auth.settings.table_group_name else 'group_id'
+        grid = SQLFORM.grid(table, args=request.args[:1], orderby=table[orderby],
+                            user_signature=True, maxtextlength=1000, formname=formname)    
+    return grid if request.extension=='load' else dict(grid=grid)
+
+def manage():
+    tablename = request.args(0)
+    if tablename in auth.db.tables:
+        grid = SQLFORM.smartgrid(auth.db[tablename], args=request.args[:1])
+    else:
+        return dict()
+    return grid if request.extension=='load' else dict(grid=grid)
diff --git a/applications/welcome/controllers/default.py b/applications/welcome/controllers/default.py
index e43cbc46..4be8679f 100644
--- a/applications/welcome/controllers/default.py
+++ b/applications/welcome/controllers/default.py
@@ -37,9 +37,7 @@ def user():
         @auth.requires_permission('read','table name',record_id)
     to decorate functions that need access control
     """
-    auth.settings.manager_group_id=1
-    return auth() if request.extension=='load' else dict(form=auth())
-
+    return dict(form=auth())
 
 @cache.action()
 def download():
diff --git a/applications/welcome/views/appadmin.html b/applications/welcome/views/appadmin.html
index 95c60ecf..2fe1817b 100644
--- a/applications/welcome/views/appadmin.html
+++ b/applications/welcome/views/appadmin.html
@@ -247,3 +247,39 @@
     {{=IMG(_src=URL('appadmin', 'bg_graph_model'))}}
   {{pass}}
 {{pass}}
+
+{{if request.function == 'auth_manage':}}
+<h2>{{=T('Manage Access Control')}}</h2>
+<ul class="nav nav-tabs">
+  <li class="active"><a href="#users" data-toggle="tab">Users</a></li>
+  <li><a href="#roles" data-toggle="tab">Roles</a></li>
+  <li><a href="#permissions" data-toggle="tab">Permissions</a></li>
+</ul>
+
+<div class="tab-content">
+  <div class="tab-pane active" id="users">
+    {{=LOAD(f='auth_manage.load', args=auth.settings.table_user_name,ajax=True)}}
+  </div>
+  <div class="tab-pane" id="roles">
+    {{=LOAD(f='auth_manage.load', args=auth.settings.table_group_name,ajax=True)}}
+  </div>
+  <div class="tab-pane" id="permissions">
+    {{=LOAD(f='auth_manage.load', args=auth.settings.table_permission_name,ajax=True)}}
+  </div>
+</div>
+{{elif request.function == 'manage':}}
+<h2>{{=T('Manage Access Control')}}</h2>
+<ul class="nav nav-tabs">
+  {{for k,tablename in enumerate(auth.db.tables):}}
+  <li><a href="#table-{{=tablename}}" data-toggle="tab">{{=tablename}}</a></li>
+  {{pass}}
+</ul>
+
+<div class="tab-content">
+  {{for tablename in auth.db.tables:}}
+  <div class="tab-pane" id="table-{{=tablename}}">
+    {{=LOAD(f='manage.load', args=tablename,ajax=True)}}
+  </div>
+  {{pass}}
+</div>
+{{pass}}
diff --git a/applications/welcome/views/default/user.html b/applications/welcome/views/default/user.html
index 64433249..195407a3 100644
--- a/applications/welcome/views/default/user.html
+++ b/applications/welcome/views/default/user.html
@@ -1,23 +1,5 @@
 {{extend 'layout.html'}}
-{{if request.args(0) == 'manage':}}
-<h2>{{=T('Manage Access Control')}}</h2>
-<ul class="nav nav-tabs">
-  <li class="active"><a href="#users" data-toggle="tab">Users</a></li>
-  <li><a href="#roles" data-toggle="tab">Roles</a></li>
-  <li><a href="#permissions" data-toggle="tab">Permissions</a></li>
-</ul>
-<div class="tab-content">
-  <div class="tab-pane active" id="users">
-    {{=LOAD(f='user.load', args=[request.args(0), auth.settings.table_user_name], ajax=True, user_signature=True)}}
-  </div>
-  <div class="tab-pane" id="roles">
-    {{=LOAD(f='user.load', args=[request.args(0), auth.settings.table_group_name], ajax=True, user_signature=True)}}
-  </div>
-  <div class="tab-pane" id="permissions">
-    {{=LOAD(f='user.load', args=[request.args(0), auth.settings.table_permission_name], ajax=True, user_signature=True)}}
-  </div>
-</div>
-{{else:}}
+
 <h2>{{=T( request.args(0).replace('_',' ').capitalize() )}}</h2>
 <div id="web2py_user_form">
 {{
@@ -40,4 +22,4 @@ jQuery("#web2py_user_form input:visible:enabled:first").focus();
     web2py_validate_entropy(jQuery('#no_table_new_password'),100);
 {{pass}}
 //--></script>
-{{pass}}
+