fixed a small bug in app_controller.php related to permissions