re #71 clean up user permission logic