permission req now works