only use add_filter (add_action is just an alias)

forget about wp_query, and tie the whole thing to a global at the
end
tests for permissions