fixing security checks with @Permissions