rework the has_permission code to work for noauth