Add check for authenticated permissions to user_access(), close #161.