move the permission filter before the count check. refs #181