Missed an ! in a permission check client-side....