updated logic of redirect based on permissions