added permission check to users and upload page by role