some additions to decodeurl
correct template syntax on permission checks