bugfix: user can have multiple permissions