title: Firebase security rule gives permission denied?
body: <p>I'm struggling to set the proper security rules for my application.</p>
  
  <p>An overview of the application I'm writing is that users can register themselves using email and password (I'm using Firebase Simple Login for this which works perfectly). Once logged in, user can add their todos.</p>
  
  <pre><code>angularFire('https://&lt;firebase&gt;/firebaseio.com/todos', $scope, 'todos');
  </code></pre>
  
  <p>And to add a new todo against any user, I simply update the todos model.</p>
  
  <pre><code>$scope.todos.push({
     user: 'a@b.com',
     todo: 'What to do?'
  });
  </code></pre>
  
  <p>This security rules I'm using to restrict non-registered user to add any todo:</p>
  
  <pre><code>  {
      "rules": {
        ".read": true,
        "todos": {
          ".write": "auth != null",
          ".validate": "auth.email == newData.child('user').val()"
        }
      }
    }
  </code></pre>
  
  <p>But it does not allow even an authenticated user to write any data and throwing an error, 
  "FIREBASE WARNING: on() or once() for /todos failed: Error: permission_denied."</p>
  
  <p>But If I add the following data in simulator then it works as expected.</p>
  
  <pre><code>{user: "a@b.com", todo: 'What to do?'} 
  </code></pre>
  
  <p>Here is the log:</p>
  
  <pre><code>/todos:.write: "auth != null"
      =&gt; true
  /todos:.validate: "auth.email == newData.child('user').val()"
      =&gt; true
  /todos:.validate: "auth.email == newData.child('user').val()"
      =&gt; true
  
  Write was allowed.
  </code></pre>