fix permission checking on public blog