make sure a string is actually a permission