updated user permission check