fixed user perm checks