Fixed logic in permissions checker to ensure token is for the right user.