fix 403 on notification/user

Seems you wrote some strange user_access checks.