properly call "userIsOwner" from "permission" now