fixed a bug in the client-side permission system